Password Generator

Draw a password of 4 to 64 characters from a pool of up to 88 symbols using your browser's cryptographic random source, with the last twenty results kept on screen.

What is the Password Generator?

This page picks characters at random from whichever classes you enable and strings them together. The randomness comes from crypto.getRandomValues, the browser's cryptographic generator, rather than Math.random, which matters because Math.random is predictable enough that seeing one output can reveal the next. With all four classes switched on the pool is 88 characters, which works out to about 6.46 bits of entropy per character. The strength bar reports that running total and nothing else.

Key Features

• Length slider from 4 to 64 characters, starting at 16
• Four character classes: uppercase, lowercase, digits, and 26 punctuation symbols
• Optional filters for look-alike characters and for bracket-style punctuation
• Entropy-based strength bar with five bands from Very Weak to Very Strong
• A rolling history of the last twenty passwords, each with a copy button

Common Use Cases

• Creating a distinct password for a new account instead of recycling an old one
• Generating a service credential that no human will ever need to remember
• Producing several candidates at once and keeping the one easiest to retype
• Replacing a password after a breach notice arrives for a site you use

How to Use the Password Generator

1. Drag the Password Length slider to the number of characters the site allows.
2. Tick or untick Uppercase, Lowercase, Numbers and Symbols to set the pool.
3. Turn on Exclude Similar if the password will be read aloud or copied by hand.
4. Press Generate Password until one comes up that suits you.
5. Hit Copy, paste it into your password manager, then clear the history.

Tips for Best Results

• Length beats complexity: a 24-character lowercase string outscores a 10-character one using every class.
• Exclude Similar drops 1, l, I, 0 and O, which costs you five characters of pool.
• Dragging the slider regenerates at every step, so the history fills with intermediate passwords.
• That history lives in memory only and vanishes on refresh, but stays visible until you clear it.

Why Use WiserWork's Password Generator?

A password you invent yourself carries your fingerprints: a birth year, a keyboard pattern, a substitution like 4 for A that cracking tools learned decades ago. A generated string has none of that structure, which is the entire point of using one. Worth knowing about the readout, though: it is derived purely from length and pool size, so the crack-time labels are broad bands rather than a model of any particular attacker.

Who Uses the Password Generator?

People setting up an account who would rather not reuse an old password reach for it most. Developers use it for service credentials that only ever live in a secrets store. It also gets opened by anyone who has just received a breach notification and needs a replacement in the next thirty seconds.

Frequently Asked Questions

Does this use secure randomness?

Yes. Every character is chosen with crypto.getRandomValues, the browser's cryptographically secure generator. Math.random is not used anywhere in the generation.

How long should a password be?

Sixteen characters from the full pool gives roughly 103 bits of entropy, far beyond what current hardware can search. The slider allows 4 to 64; the short end exists for systems with rigid limits, not because it is advisable.

Which symbols are included?

Twenty-six of them: exclamation mark, at sign, hash, dollar, percent, caret, ampersand, asterisk, parentheses, underscore, plus, minus, equals, square brackets, braces, pipe, semicolon, colon, comma, period, the two angle brackets, and question mark.

What does Exclude Ambiguous actually remove?

Parentheses, square brackets, braces, comma, semicolon, colon, period and the two angle brackets. Its label also names slashes, quotes, backtick and tilde, but those are not in the symbol set to begin with, so striking them changes nothing.

Are the passwords saved anywhere?

Not to disk. The history panel is a plain array held in the page, so a refresh wipes it, and nothing is written to browser storage or sent over the network.

Why does the history keep filling up?

Every setting change regenerates, including each step as you drag the length slider. The panel keeps the twenty most recent and discards older ones, and the Clear button empties it.

What does the crack time estimate mean?

It maps the entropy total onto one of five fixed labels, from Instantly under 28 bits up to Centuries plus at 80 bits and above. It knows nothing about the target site's hashing or an attacker's hardware.

Can I generate a password with no symbols?

Yes, untick Symbols. Some legacy systems reject punctuation outright, and a 20-character alphanumeric password is a sensible answer to that restriction.

What if I untick every class?

The display reads Select at least one option and the strength bar drops to zero. At least one character class has to stay enabled for there to be anything to draw from.

Should I memorize the password it gives me?

Usually not. A generated string is meant to live in a password manager. Reserve memorization for the handful you must type by hand, such as your device login and manager master password, and use a long passphrase for those.

The strongest password is the one you never had to think of. Set a length, pick your character classes, generate, and get the result into a manager before you clear the history and close the tab.